Version 6.0.0

[scarroll32]

Note

This PR was opened by Claude (Claude Code), acting on behalf of @scarroll32.
Draft: merge last, when 6.0.0 is released (planned on October 10, 2026, after a testing period against main). Merging it and publishing a GitHub Release tagged v6.0.0 publishes the gem; see the release flow.

Bumps Ransack::VERSION to 6.0.0. Closes #1640 when it merges.

The text below is a draft of the release notes, compiled from the eight PRs of the 6.0.0 stack, ready to paste into the GitHub Release.

---

Security

• Bounds the multiparameter position (created_at(1i)) in search params and drops malformed keys, closing a memory-exhaustion denial of service where a crafted q[created_at(100000000000i)]=1 made the server allocate an array of that size. GHSA-vxc9-rm8f-p56j, reported by @connorshea. Also released as 5.0.1 and 4.4.2.
• Bounds the depth of a search key, closing a denial of service where a crafted q[...] condition key or q[s] sort value with thousands of _-separated segments was parsed in quadratic time and exhausted CPU. Not mitigated by attribute allowlisting. GHSA-j3f8-w227-4hh8. Also released as 5.0.2 and 4.4.3.

Breaking changes

• Ruby 3.2 or later is required. Ruby 3.1 is end-of-life and no patched sqlite3 exists for it. — Drop Ruby 3.1 support #1705, closes Drop Ruby 3.1 support in 6.0.0 #1686
• cont, start, end and matches are case-sensitive on PostgreSQL. They render as LIKE; the i_ forms (i_cont, and the new i_start and i_end) are ILIKE. Before, every LIKE on PostgreSQL was rendered as ILIKE, so cont and i_cont were indistinguishable there. Nothing raises when a search turns case-sensitive, it just stops matching rows whose case differs, so check filters wired up by another library: ActiveAdmin's string filter offers cont, start and end. MySQL and SQLite are unchanged. — Detect the SQL dialect from the adapter class; drop the PostGIS dependency #1707, closes Ransack does not distinguish between "*_cont" for LIKE and "*_i_cont" for ILIKE with PostgreSQL #1421; Add i_start and i_end, the case-insensitive start and end predicates #1716, closes 6.0.0 feedback: cont/start/end became case-sensitive on PostgreSQL, and start/end have no i_ variant to move to #1715
• Polyamorous is gone; Ransack::Adapters::ActiveRecord is deprecated. The Active Record integration lives under Ransack::ActiveRecord. The old constant still resolves with a deprecation warning and goes in 7.0; Polyamorous::Join is Ransack::ActiveRecord::Join; Ransack::SUPPORTS_ATTRIBUTE_ALIAS and Ransack::Context.for_class / for_object are removed (see the resolver registry below). — Fold Polyamorous and Ransack::Adapters into Ransack::ActiveRecord #1706, closes Remove Polyamorous and Adapters namespaces #1625, Refactor Ransack modules and file structure #1631
• sorts= replaces instead of appending, so search.sorts = [] clears the sorts; build_sort still adds one. — Resolve ransack_alias through associations and compounds; sorts= replaces; scopes win in the writer #1711, closes Confusing sorts behavior #994
• Strict searches (ransack!, ignore_unknown_conditions = false) check more: an invalid sort raises InvalidSearchError instead of silently dropping the whole ORDER BY, and a condition name mixing _and_ and _or_ raises instead of applying the first combinator to every attribute. — Fix ten small, self-contained bugs from the issue triage #1708, closes ignore_unknown_conditions apply to non-allowed attributes for SORT too? #1427, Behavior when 'and' and 'or' are mixed in the symbol representing the target column #1019
• Joins already on the relation are reused. A search on a relation that already joins a table (joins, left_outer_joins, an eager-loaded includes, a previous search) no longer adds a second aliased join, so row counts from searches that hit the duplicate-join bug change. Ransack's own joins are now stashed in left_outer_joins_values. — Reuse the joins a relation already has #1710
• Values are cast by the declared attribute type, so attribute :x, :datetime is honoured, and a Date given for a datetime column means midnight in Time.zone rather than the server's system zone. — Fix ten small, self-contained bugs from the issue triage #1708, closes Date attributes aren't coerced as datetime when using "attribute attr, :datetime" in model #1028, Range of Dates Query converting to UTC before query #1436
• A scope listed in ransackable_scopes_skip_sanitize_args receives false instead of being skipped, so it can drive a yes/no/any select. — Fix ten small, self-contained bugs from the issue triage #1708, closes ransackable_scope with boolean value is skipped #1375
• The PostGIS development dependency and its CI job are gone. PostGIS is recognised as PostgreSQL by adapter ancestry. — Detect the SQL dialect from the adapter class; drop the PostGIS dependency #1707, closes Remove PostGIS dependency #1633

Every item above is explained, with what to change, on the docs' Upgrading page.

Features

• config.strong_parameters = true (off by default) trusts permitted ActionController::Parameters as the authorization: the controller's permit list replaces ransackable_attributes, ransackable_associations and ransortable_attributes for that search; ransack(params, strong_parameters: true / false) overrides per search. Scopes stay gated, plain hashes and unpermitted params keep the model lists. — Let strong parameters authorize a model with no allowlist #1717, closes Extend 4.0.0 allow/deny listing with Strong Parameters #1403
• i_start, i_end, their not_ opposites and _any / _all compounds: case-insensitive starts-with and ends-with, mirroring i_cont (ILIKE on PostgreSQL, LOWER(col) LIKE elsewhere). — Add i_start and i_end, the case-insensitive start and end predicates #1716, closes 6.0.0 feedback: cont/start/end became case-sensitive on PostgreSQL, and start/end have no i_ variant to move to #1715
• SQL dialect detection from the adapter class, with a config.dialect override for unknown adapters; the two database-specific decisions Ransack makes (LOWER() versus ILIKE, CHAR_LENGTH versus LENGTH) now read the searched model's connection, so multi-database apps get the right SQL. — Detect the SQL dialect from the adapter class; drop the PostGIS dependency #1707, closes Explicitly support connection adapters #1639, Doesn't work correctly with active multiple databases #1407
• Ransack::Context.register: a resolver registry so an integration for another ORM can plug in without patching Ransack. — Fold Polyamorous and Ransack::Adapters into Ransack::ActiveRecord #1706
• ransack_alias resolves through associations (person_term for an alias on Person) and inside _or_ / _and_ compounds; the alias itself no longer needs allowlisting, only its targets. — Resolve ransack_alias through associations and compounds; sorts= replaces; scopes win in the writer #1711, closes ransack_alias doesn't work in associations #1520, Add the ability to combine aliases #847, ransack_alias missing method not throwing #741
• predicate_name: is accepted alongside predicate: in long-form conditions, as the ransackers docs always said. — Fix ten small, self-contained bugs from the issue triage #1708, closes Ransacker params with alias for Passing Arguments #1009

Bug fixes

• Duplicate LEFT OUTER JOINs on left_outer_joins + a condition on the same association (multiplied rows for has_many), on chained searches, under includes + pluck, and for nested pre-existing joins; wrong alias when the same table is joined twice; where(assoc: {...}) alias not followed. — Reuse the joins a relation already has #1710, closes Ransack is not correctly overriding/using previous joins #824, Erroneous double-join when using pluck #1108, Duplicate (exponential) LEFT OUTER JOINS #1250, Ransack generates redundant left join statements #1433, SQL aliases are not supported when joining relations - at least with PG #1437, Single filter with multiple joins use the wrong association alias #1554
• i_cont did not lower a ransacker expression on databases without ILIKE. — Detect the SQL dialect from the adapter class; drop the PostGIS dependency #1707, closes Custom ransackers not following case-insensitive behavior #1357
• from_id_or_to_id_eq on a polymorphic association raised "Polymorphic associations do not support computing the class"; f.label on an _of_Model_type attribute raised the same. — Fix ten small, self-contained bugs from the issue triage #1708, closes Polymorphic filtering is inconsistent #1267, label for polymorphic association throws ArgumentError:"Polymorphic associations do not support computing the class" #1557
• Context#join_sources raised when the relation had joins(:x) (the merging-searches recipe). — Fix ten small, self-contained bugs from the issue triage #1708, closes NoMethodError: undefined method 'join_root' for an instance of Symbol #1659
• search_form_with did not read field values back (Search lacked respond_to_missing?). — Fix ten small, self-contained bugs from the issue triage #1708
• A scope sharing a column's name was ignored by the writer and form builders. — Resolve ransack_alias through associations and compounds; sorts= replaces; scopes win in the writer #1711, closes [Suggestion] Check for ransackable_scopes before checking attribute searches. #1472
• The last ruby -w warnings from lib/. — Fix ten small, self-contained bugs from the issue triage #1708, closes Ruby 4.0 warnings: method redefinitions, unused variables, mismatched indentation #1669

Documentation

• The site is built with Jekyll and Just the Docs instead of Docusaurus: same URLs, built-in search, a link check in CI, and no npm tree. — Replace Docusaurus with Just the Docs #1713, closes Replace Docusaurus with Just the Docs #1680, Simplify documentation #1613
• New pages: Upgrading, How Ransack is built (module map, the Context seam, the exact list of Active Record internals Ransack touches). Sections on databases and dialects, case sensitivity, negative predicates on collections, searching a relation that already has joins, aliases through associations, scopes and false, scopes and OR, searching everything, Action Text, encrypted attributes, EXISTS via a scope, a fixed attribute with a predicate select. — Fold Polyamorous and Ransack::Adapters into Ransack::ActiveRecord #1706, Detect the SQL dialect from the adapter class; drop the PostGIS dependency #1707, Fix ten small, self-contained bugs from the issue triage #1708, Reuse the joins a relation already has #1710, Resolve ransack_alias through associations and compounds; sorts= replaces; scopes win in the writer #1711, Document what the issue triage found already answered #1712

Internal

• append_constraints is called by arity, so both shapes Active Record has shipped work; Rails floor stays at 7.2. — Fold Polyamorous and Ransack::Adapters into Ransack::ActiveRecord #1706
• The suite has no pending examples; CI tests Rails 7.2.2.1 rather than 7.2.2. — Document what the issue triage found already answered #1712, Fold Polyamorous and Ransack::Adapters into Ransack::ActiveRecord #1706

---

🤖 Generated with Claude Code

[connorshea]

Thank you for all the work on this 🙇